CVE-2024-25693: critical vulnerability in Esri Portal for ArcGIS
Portal for ArcGIS has a directory traversal vulnerability.
Published · Updated
No sign of exploitation. No public exploitation artifact known so far.
Portal for ArcGIS allows authenticated users to bypass folder restrictions and access files anywhere on the server by using specially crafted paths. This is critical because attackers can read sensitive files or execute malicious code.
A path traversal vulnerability in Portal for ArcGIS (≤11.2) permits authenticated attackers to escape directory boundaries using path manipulation techniques, enabling unauthorized file system access and potential arbitrary code execution. The vulnerability requires valid credentials but allows circumventing intended access controls through crafted relative or absolute path sequences.
In the same product, most dangerous first.